@mariozechner/jiti

Name lookalikedanger

The artifact overlap is 1.0 and the README identifies the package as the lookalike, while it has only 4 stable releases versus jiti's 101. Consumers most likely wanted jiti itself, making this a severe identity and supply-chain concern.

Release historycaution

All 4 releases occurred within a single burst on January 13, 2026, with no sustained release cadence observed afterward.

Repo commit activitycaution

The repository had 0 commits and 0 active maintainers in the last three months, indicating no observed ongoing maintenance for this release.

Repo popularitycaution

The repository has only 6 stars and 6 forks, providing little independent evidence of adoption or review. Low popularity alone is not decisive, but it offers no meaningful counterweight to the maintenance concerns.

Workflow auditcaution

Six of 7 action references are unpinned, and both workflows install packages outside a lockfile; these are high-confidence hygiene weaknesses, though no untrusted checkout or script-injection path was found.